SSL protocol and cipher configuration in Nginx - Step-by-Step Execution

Process Flow - SSL protocol and cipher configuration

Start nginx config

↓

Set ssl_protocols

↓

Set ssl_ciphers

↓

Reload nginx

↓

Client connects

↓

SSL handshake uses configured protocols and ciphers

↓

Connection established or rejected

The flow shows how nginx reads SSL protocol and cipher settings, reloads, then clients connect using those settings for secure communication.

Execution Sample

Nginx

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;

This config sets nginx to accept only TLS 1.2 and 1.3 protocols and use strong ciphers, preferring server choice.

Process Table

Step	Action	Configuration State	Effect on SSL Handshake
1	Read ssl_protocols	Protocols set to TLSv1.2, TLSv1.3	Only TLS 1.2 and 1.3 allowed
2	Read ssl_ciphers	Ciphers set to HIGH strength, exclude aNULL and MD5	Only strong ciphers accepted
3	Read ssl_prefer_server_ciphers	Server cipher preference enabled	Server chooses cipher from client's list
4	Reload nginx	New SSL settings active	Clients must use allowed protocols and ciphers
5	Client connects with TLS 1.2 and strong cipher	Handshake succeeds	Secure connection established
6	Client connects with TLS 1.0	Handshake fails	Connection rejected due to protocol
7	Client connects with weak cipher	Handshake fails	Connection rejected due to cipher

💡 Execution stops after client connection attempts show which protocols and ciphers are accepted or rejected

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	Final
ssl_protocols	none	TLSv1.2, TLSv1.3	TLSv1.2, TLSv1.3	TLSv1.2, TLSv1.3	TLSv1.2, TLSv1.3
ssl_ciphers	none	none	HIGH:!aNULL:!MD5	HIGH:!aNULL:!MD5	HIGH:!aNULL:!MD5
ssl_prefer_server_ciphers	off	off	off	on	on

Key Moments - 3 Insights

Why does a client using TLS 1.0 fail to connect even if it supports some strong ciphers?

Because ssl_protocols only allows TLS 1.2 and TLS 1.3 (see execution_table step 6), the handshake fails due to unsupported protocol regardless of cipher strength.

What happens if ssl_prefer_server_ciphers is off?

The client chooses the cipher from its list, which may be weaker. With it on (step 3), the server picks the strongest cipher it supports, improving security.

Why exclude aNULL and MD5 ciphers in ssl_ciphers?

aNULL ciphers have no authentication and MD5 is weak. Excluding them (step 2) ensures only secure ciphers are used, preventing weak handshake security.

Visual Quiz - 3 Questions

Look at the execution_table, at which step does nginx activate the new SSL settings?

A Step 4

B Step 2

C Step 6

D Step 1

💡 Hint

Check the 'Action' and 'Configuration State' columns for when nginx reloads to apply settings.

According to variable_tracker, what is the value of ssl_prefer_server_ciphers after step 3?

A on

B off

C none

D undefined

💡 Hint

Look at the ssl_prefer_server_ciphers row under 'After Step 3' column.

If you add TLSv1.1 to ssl_protocols, which step in execution_table would change?

A Step 5

B Step 7

C Step 1

D Step 4

💡 Hint

Adding TLSv1.1 changes the protocols set, which is reflected in the 'Configuration State' at step 1.

Concept Snapshot

nginx SSL config:
ssl_protocols TLSv1.2 TLSv1.3;  # Allowed SSL/TLS versions
ssl_ciphers HIGH:!aNULL:!MD5;    # Strong ciphers only
ssl_prefer_server_ciphers on;    # Server picks cipher
Reload nginx to apply changes.
Clients must use allowed protocols and ciphers to connect.

Full Transcript

This visual execution shows how nginx reads SSL protocol and cipher settings from its configuration. First, it sets allowed protocols to TLS 1.2 and 1.3, then sets strong ciphers excluding weak ones like aNULL and MD5. It enables server preference for cipher selection. After reloading nginx, these settings become active. When clients connect, only those using allowed protocols and ciphers succeed. Connections using older protocols or weak ciphers fail. Variables ssl_protocols, ssl_ciphers, and ssl_prefer_server_ciphers change step-by-step as nginx reads the config. Key moments clarify why protocol restrictions cause connection failures and why server cipher preference improves security. The quiz tests understanding of when settings activate and variable values during execution.